If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

It will show you deleted files, and what condition they are in from a recovery viewpoint. It does not look at cluster tips as far as I know. If the user has simply deleted the files and emptied the recycle bin then RECUVA is a good enough tool for the job.

I believe that you can with versions 5.0 and higher but if not, you can just select the partition. It is more of a bulk processing tool, and does find stuff in cluster tips, so I would be inclined to go for all partitions that have been used (I think you said c:/?) as you never know what you might find I would use RECUVA first though.

Using RECUVA, it doesn't recover the pictures from the folder, but if you recover pictures, you don't know what folder they were in. Is it possible to know that with Roadkil or is there a software that can tell you that after recovering those pictures(all pictures on the hard drive)

The short answer is "no", Windows locks the file on bootup, so you have to find a work around:

3. With XP (not sure about Vista) go into Control Panel and Advanced Settings and change the "virtual memory" to manual and pick a different size...........this will move it to a new location (root of C:\ I think) but leave the old file there. Reboot and the old file will not be locked. If it is already manual then change it to "let Windows decide", as this will have the same effect apart from the unlocked file being in the other location.

Can i change it back after doing that so it is not seen by the user(the change)? What size to pick?

Using RECUVA, it doesn't recover the pictures from the folder, but if you recover pictures, you don't know what folder they were in. Is it possible to know that with Roadkil or is there a software that can tell you that after recovering those pictures(all pictures on the hard drive)

Ah! you have several questions here, I think?

1. If RECUVA does not recover pictures from what YOU think OUGHT to be the target folder, then they are NOT there. Now, that could be because you got the folder identification wrong, the files were moved prior to being deleted, or they haven't been deleted at all, and are still there on the HDD, only in a different location.

2. I think that you need to change the RECUVA settings?........... if you are looking at a screen with a load of thumbnail images, then you need to look in the top right and click on the radio button called: "Switch to advanced mode". RECUVA will then give you a listing screen that has the access paths to the files.

3. BE AWARE! RECUVA will only show files it has detected as deleted........... NOT MOVED. It will also only show you the location of the file when it was deleted; not where it might have been before.

4. Roadkil would be totally useless as it doesn't use Windows file tables at all.

Can i change it back after doing that so it is not seen by the user(the change)? What size to pick?

1. Yes.
2. Whatever it was before.

where is "Custom Size" or "System Managed Size"?

If you followed my instructions: on the screen in front of you

I don't understand that. you said there is more than one file(pagefile.sys)

OK, joking apart............. there can be more than one pagefile...... one per HDD at least, but there will be two, where you have had a manually set drive and have then let Windows manage it, or vice versa. I was suggesting that we use this feature to allow you to copy the old pagefile.

Where do i find this hidden part? Can i find it even if it was deleted?

No

Would i be able to recover the pictures from their metadata?

No............they are a single file so if it ain't there it ain't.

How can i recover all of the browser history then?

You can't.

Can't you just open the .bak file and see what's in it with a software?

Please can you recommend what software to use for that task? I don't know of any.

What would be in it that wouldn't be in the computer?

Stuff that had since been deleted or corrupted. Assuming that the backup is on the same machine, which it isn't; and that you have the recovery media, which you don't.

I ASKED YOU THREE QUESTIONS:

1. Who owns the computer?
2. How many people currently use it/have access to it?
3. How many of those have system or local administrator privileges?

But dino~ ............whenever I do something like that, somebody slaps my wrist

Anyways, if somebody doesn't understand English that well, it is rather rude to flame, be sarcastic, ironic, facetious or supercilious. Hell! there are five year olds in their country speak their language better than I do ........... well except for when I ask for the bill

Hell! as you well know, I have upset people on this forum over the years ..... but only if it was a fair fight.

I do see your point mate! but I am afraid that some people watch too much CSI/NCIS and I think that our pilgrim is one of those?

BTW to those whom it may concern.......... I am NEVER condescending .... hey, that implies that you take prisoners doesn't it?

Just West of Beantown, though nobody from Beantown actually calls it "Beantown."

Posts

1,229

Originally Posted by nihil

@BB

Very true, but I don't think that the OP can afford the alternatives or even the learning curve required.......... and that is notwithstanding evidence acceptability requirements?

I just suggested what I thought might be the best options for commonly available free stuff, given that my practical experiences have been almost exclusively simple disaster recovery situations.

A while back an acquaintance did give me a copy of that Microsoft "Coffee" (spelling could be different?) to evaluate for her............... I cannot say that I was that impressed..... have you ever seen it or have any thoughts?

Sorry Nihil... I really don't come here very often any more...

I got my copy of Cofee and I was also unimpressed. Although Cofee is not really a "Forensics tool" when you get down to it. There are other tools that do what Cofee does, and much better.

That's Officer 11001001 to you...Now you see me | Now you don't
"Relax, Bender; It was just a dream. There's no such thing as two." ~ Frysometimes my computer goes down on me

Hello, nihil! I couldn't agree with you more. As you said that, OVERWRITTEN data cannot be recovered since they are GONE FOREVER. I accidentally deleted some pictures and video files on the SD card. Then I immediately stopped using my digital camera and took out the memory card. I think the lost multimedia files should not be overwritten. However, I do not know which data recovery tool should be selected. Please give me some advices. Thank you!

Hello, nihil! I couldn't agree with you more. As you said that, OVERWRITTEN data cannot be recovered since they are GONE FOREVER. I accidentally deleted some pictures and video files on the SD card. Then I immediately stopped using my digital camera and took out the memory card. I think the lost multimedia files should not be overwritten. However, I do not know which data recovery tool should be selected. Please give me some advices. Thank you!

Hello, Shay! Thank you very much! In fact, I tried a lot of data recovery tools, such as Stellar Phoenix, SoftHow Photo Recovery, EaseUS, Wondershare, etc. They are great data recovery tools. However, for financial reasons I would like to use the free data recovery software. According to your recommendation, I found a free version of Recuva. Thanks again!